Get 20M+ Full-Text Papers For Less Than $1.50/day. Start a 14-Day Trial for You or Your Team.

Learn More →

Explaining small business InfoSec posture using social theories

Explaining small business InfoSec posture using social theories PurposeThis study aims to investigate information technology security practices of very small enterprises.Design/methodology/approachThe authors perform a formal information security field study using a representative sample. Using the Control Objectives for IT (COBIT) framework, the authors evaluate 67 information security controls and perform 206 related tests. The authors state six hypotheses about the findings and accept or reject those using inferential statistics. The authors explain findings using the social comparison theory and the rare events bias theory.FindingsOnly one-third of all the controls examined were designed properly and operated as expected. About half of the controls were either ill-designed or did not operate as intended. The social comparison theory and the rare events bias theory explain managers’s reliance on small experience samples which in turn leads to erroneous comprehension of their business environment, which relates to information security.Practical implicationsThis information is valuable to executive branch policy makers striving to reduce information security vulnerability on local and national levels and small business organizations providing information and advice to their members.Originality/valueInformation security surveys are usually over-optimistic and avoid self-incrimination, yielding results that are less accurate than field work. To obtain grounded facts, the authors used the field research approach to gather qualitative and quantitative data by physically visiting active organizations, interviewing managers and staff, observing processes and reviewing written materials such as policies, procedure and logs, in accordance to common practices of security audits. http://www.deepdyve.com/assets/images/DeepDyve-Logo-lg.png Information and Computer Security Emerald Publishing

Explaining small business InfoSec posture using social theories

Rohn, Eli; Sabari, Gilad; Leshem, Guy
Information and Computer Security , Volume 24 (5): 23 – Nov 14, 2016
Download PDF
23 pages

Loading next page...
 
/lp/emerald-publishing/explaining-small-business-infosec-posture-using-social-theories-tQN4rLaST7

References (37)

Publisher
Emerald Publishing
Copyright
Copyright © Emerald Group Publishing Limited
ISSN
2056-4961
DOI
10.1108/ICS-09-2015-0041
Publisher site
See Article on Publisher Site

Abstract

PurposeThis study aims to investigate information technology security practices of very small enterprises.Design/methodology/approachThe authors perform a formal information security field study using a representative sample. Using the Control Objectives for IT (COBIT) framework, the authors evaluate 67 information security controls and perform 206 related tests. The authors state six hypotheses about the findings and accept or reject those using inferential statistics. The authors explain findings using the social comparison theory and the rare events bias theory.FindingsOnly one-third of all the controls examined were designed properly and operated as expected. About half of the controls were either ill-designed or did not operate as intended. The social comparison theory and the rare events bias theory explain managers’s reliance on small experience samples which in turn leads to erroneous comprehension of their business environment, which relates to information security.Practical implicationsThis information is valuable to executive branch policy makers striving to reduce information security vulnerability on local and national levels and small business organizations providing information and advice to their members.Originality/valueInformation security surveys are usually over-optimistic and avoid self-incrimination, yielding results that are less accurate than field work. To obtain grounded facts, the authors used the field research approach to gather qualitative and quantitative data by physically visiting active organizations, interviewing managers and staff, observing processes and reviewing written materials such as policies, procedure and logs, in accordance to common practices of security audits.

Journal

Information and Computer Security – Emerald Publishing

Published: Nov 14, 2016

There are no references for this article.